CVE-2024-34067

CVE-2024-34067 is a Cross-Site Scripting (XSS) vulnerability affecting the Pterodactyl game server management panel. It allows an attacker to gain an administrator account on the panel by importing a malicious egg or gaining access to a Wings instance, which then reflects malicious input in various egg-related fields. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low attack complexity, requiring user interaction, and leading to low impact on confidentiality and integrity. While the attack requires an administrator to perform specific actions, the potential to compromise an administrator account is significant. There is currently no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this CVE. Users are advised to upgrade to Pterodactyl version 1.11.6 to mitigate this vulnerability, as no other workaround is available.